Search with multiply words

PHP
1

I’m about to update my search script. The search engine searches in my database where I ask it to search. What is new is I want do some search words, that the users can check in a checkbox, if he wants to use the word in the search.

As for now my search engine works, the only problem is that it only searches the last word and not all of the checked words. My formula looks like this:

<form method="POST" action="<?=$_SERVER["PHP_SELF"]?>">
<p>Search for:
</p>
Books: <input type="checkbox" name='search' value="books">
Movies: <input type="checkbox" name='search' value="movies">
Outdoor: <input type="checkbox" name='search' value="outdoor">
Indore: <input type="checkbox" name='search' value="indore">
</p>
<p><input type='submit'  value='Search'></p>
</form>

The php code looks like:

&lt;?php
if(isset($_POST['search']))
{
  $connx = mysql_connect('localhost', '*******', ',*********') or die("connx");
  $db = mysql_select_db('*********') or die(mysql_error());

  # convert to upper case, trim it, and replace spaces with "|":
  $search = mysql_real_escape_string($search);
  $search = strtoupper(preg_replace('/\\s+/', '|', ($_POST['search'])));

  # create a MySQL REGEXP for the search:
  $regexp = "REGEXP '[[:&lt;:]]($search)[[:&gt;:]]'";
  $query = "SELECT * FROM `keywords` WHERE UPPER(`keywords01`) $regexp OR ".
           "`keywords02` $regexp OR ".
           "`keywords03` $regexp OR ".
           "`keywords04` $regexp";

  $result = mysql_query($query) or die($query . " - " . mysql_error());

echo "&lt;table&gt;\
";
while($row = mysql_fetch_assoc($result))

{
    echo "&lt;tr&gt;";
	echo "&lt;td&gt;&lt;img src=../{$row['type']}/{$row['folder']}/{$row['date']}-{$row['num']}/{$row['thumbimage']} border=1&gt;&lt;/td&gt;";
    echo "&lt;td&gt;{$row['name']}&lt;/td&gt;";
    echo "&lt;td&gt;{$row['date']}&lt;/td&gt;";
    echo "&lt;td&gt;&lt;a href=../view.php?id={$row['id']} target=blank&gt;VIEW&lt;/a&gt;&lt;/td&gt;";
    echo "&lt;/tr&gt;\
";
  }
}
 else {
  echo "&lt;p&gt;Sorry, no results matched your search.&lt;/p&gt;";
}
?&gt;

Are there someone, who can figure out, why it is only the last marked checkboxs word that are searched and not all marked words and how do I get it to search for all marked words?

Hope someone can help.

2

You’ll need to change your input names to use array syntax like:
type=“checkbox” name=‘search’

then $_POST[‘search’] will be an array. That being the case, you will then need to change your line which converts spaces to pipe.

3

As an FYI, your mysql_real_escape_string is doing nothing to protect your query.

$search = mysql_real_escape_string($search);  
  $search = strtoupper(preg_replace('/\\s+/', '|', ($_POST['search'])));

The first line would be applying mysql_real_escape_string to an empty/null string (unless you have register globals on).
Even if the first line worked, the second line is overwriting it with data found in the $_POST array.

4

Thanks QMonkey. You say:

then $_POST[‘search’] will be an array. That being the case, you will then need to change your line which converts spaces to pipe.

How do I do that? How would look like? Can you please show me the code?

Hope you can help have been stocked with this for the last 4 days now :confused:

5

If it’s an array, you would just need to implode


$search = implode( '|', $_POST['search'] );

And be sure to incorporate escaping as mentioned by cpradio.

6

PERFECT its working :slight_smile: THANKS

My script now looks like:

&lt;?php 
if(isset($_POST['search'])) 
{ 
  $connx = mysql_connect('localhost', '*******', ',*********') or die("connx"); 
  $db = mysql_select_db('*********') or die(mysql_error()); 
  
  # convert to upper case, trim it, and replace spaces with "|": 
  $search = implode( '|', $_POST['search'] );  
  
  # create a MySQL REGEXP for the search: 
  $regexp = "REGEXP '[[:&lt;:]]($search)[[:&gt;:]]'"; 
  $query = "SELECT * FROM `keywords` WHERE UPPER(`keywords01`) $regexp OR ". 
           "`keywords02` $regexp OR ". 
           "`keywords03` $regexp OR ". 
           "`keywords04` $regexp"; 
  
  $result = mysql_query($query) or die($query . " - " . mysql_error()); 
  
echo "&lt;table&gt;\
"; 
while($row = mysql_fetch_assoc($result)) 

{ 
    echo "&lt;tr&gt;"; 
	echo "&lt;td&gt;&lt;img src=../{$row['type']}/{$row['folder']}/{$row['date']}-{$row['num']}/{$row['thumbimage']} border=1&gt;&lt;/td&gt;";
    echo "&lt;td&gt;{$row['name']}&lt;/td&gt;"; 
    echo "&lt;td&gt;{$row['date']}&lt;/td&gt;"; 
    echo "&lt;td&gt;&lt;a href=../view.php?id={$row['id']} target=blank&gt;VIEW&lt;/a&gt;&lt;/td&gt;"; 
    echo "&lt;/tr&gt;\
"; 
  }  
} 
 else {
  echo "&lt;p&gt;Sorry, no results matched your search.&lt;/p&gt;";
}
?&gt;

Do I miss anything to fine tune the codes?

What does this means:

incorporate escaping
IS that something I need to Work with?